From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33884) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Va4Ag-0006mO-FD for qemu-devel@nongnu.org; Sat, 26 Oct 2013 09:45:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Va4Aa-00014Q-GV for qemu-devel@nongnu.org; Sat, 26 Oct 2013 09:44:54 -0400 Received: from mx1.redhat.com ([209.132.183.28]:16442) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Va4Aa-00014K-8r for qemu-devel@nongnu.org; Sat, 26 Oct 2013 09:44:48 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r9QDikOO012263 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sat, 26 Oct 2013 09:44:46 -0400 From: Max Reitz Date: Sat, 26 Oct 2013 15:44:43 +0200 Message-Id: <1382795083-28591-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH] block: Don't copy backing file name on error List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi , Max Reitz bdrv_open_backing_file() tries to copy the backing file name using pstrcpy directly after calling bdrv_open() to open the backing file without checking whether that was actually successful. If it was not, ps->backing_hd->file will probably be NULL and qemu will crash. Fix this by moving pstrcpy after checking whether bdrv_open() succeeded. Signed-off-by: Max Reitz --- block.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block.c b/block.c index 4474012..61795fe 100644 --- a/block.c +++ b/block.c @@ -1005,8 +1005,6 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp) ret = bdrv_open(bs->backing_hd, *backing_filename ? backing_filename : NULL, options, back_flags, back_drv, &local_err); - pstrcpy(bs->backing_file, sizeof(bs->backing_file), - bs->backing_hd->file->filename); if (ret < 0) { bdrv_unref(bs->backing_hd); bs->backing_hd = NULL; @@ -1014,6 +1012,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp) error_propagate(errp, local_err); return ret; } + pstrcpy(bs->backing_file, sizeof(bs->backing_file), + bs->backing_hd->file->filename); return 0; } -- 1.8.4.1